Apache Ambari: authenticated users could perform command injection to perform RCE

ALTO 8.8CVE-2023-50379 · GHSA-rghc-9fhx-h32m · Published 27/02/2024 · updated 17/06/2026

In breve

CVE-2023-50379 è una vulnerabilità ALTO (CVSS 8.8) che riguarda org.apache.ambari.contrib.views:ambari-contrib-views, ambari (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 64.8% delle vulnerabilità.
Correzione: aggiornare a 2.7.8 o successiva.

Package	Affected versions	Patched versions
org.apache.ambari.contrib.views:ambari-contrib-views Maven	`≥ 2.7.0, < 2.7.8`	`2.7.8`
ambari apache	`< 2.7.8`	`2.7.8`

Description

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue.

Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.

NVD description

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.

References

nvd.nist.gov/vuln/detail/CVE-2023-50379 · ADVISORY
apache/ambari · WEB
lists.apache.org/thread/jglww6h6ngxpo1r6r5fx7ff7z29lnvv8 · WEB
openwall.com/lists/oss-security/2024/02/27/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free